CVE-2023-24052

Published: Dec 4, 2023Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain control of the device via the change password functionality as it does not prompt for the current password.

Affected (1)

Products: Connectize: Ac21000 G6 Firmware

Connectize

1 product

Ac21000 G6 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Connectize Ac21000 G6 Firmware	Version 641.139.1.1256

Running on/with	Platform Versions
Connectize Ac21000 G6	All versions

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve/

Source: cve@mitre.org

Third Party Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.